- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How can I extract two fields as a single field in ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How can I extract two fields as a single field in my search result. The log format is as follows :
Apr 24 18:37:07 10.11.26.83 2012-04-24 06:07:09.732 -0700 barracuda WF ALER SQL_INJECTION_IN_URL 99.99.182.1 44727 99.99.83.74 80 security-policy GLOBAL DENY NONE [type="sql-injection-medium" pattern="sql-comments" token="/"] GET 99.99.83.74/index.html// HTTP "-" "Wget/1.12 (linux-gnu)" 99.99.182.1 44727 "-" "-"
The two fields in bold letters are the application_ip and application_port fields respectively. And I want to extract the two fields together in my search results in the format of application_ip:application:port . How can this be done ?
Please help ...
Thanks...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Here is an extraction that should work with the above sample event text.I don't know what all your events look like so I can only provide an example regex based on what you provided, therefore you may need to adjust the regex as necessary to work with a wider selection of event text formats.
... | rex field=_raw "^(?i).+barracuda\s\w+\s\w+\s\w+\s\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\s\d{2,5}\s(?<ipaddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s(?<port>\d{2,5})\s.+$" | eval ip_port=ipaddress+":"+port | table ip_port
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Here is an extraction that should work with the above sample event text.I don't know what all your events look like so I can only provide an example regex based on what you provided, therefore you may need to adjust the regex as necessary to work with a wider selection of event text formats.
... | rex field=_raw "^(?i).+barracuda\s\w+\s\w+\s\w+\s\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\s\d{2,5}\s(?<ipaddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s(?<port>\d{2,5})\s.+$" | eval ip_port=ipaddress+":"+port | table ip_port
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks a lot Damien ... This works ...
Get the T-shirt to Prove You Survived Splunk University Bootcamp
Introducing the Splunk Community Dashboard Challenge!
Wondering How to Build Resiliency in the Cloud?
